Login Sign Up

CVE-2023-40267

9.8 CRITICAL

📋 TL;DR

GitPython before version 3.1.32 contains an incomplete fix for CVE-2022-24439, allowing insecure non-multi options in clone and clone_from operations. This vulnerability could allow attackers to execute arbitrary code or manipulate git operations when cloning from untrusted repositories. Anyone using vulnerable GitPython versions in applications that clone repositories is affected.

💻 Affected Systems

Products:
  • GitPython
Versions: All versions before 3.1.32
Operating Systems: All operating systems running Python
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability exists in the clone() and clone_from() methods when using non-multi options

📦 What is this software?

Gitpython by Gitpython Project

View all CVEs affecting Gitpython →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise when cloning from malicious repositories

🟠

Likely Case

Arbitrary file write/read, git repository manipulation, or limited code execution depending on application context

🟢

If Mitigated

No impact if patched or if applications only clone from trusted sources with proper input validation

🌐 Internet-Facing: HIGH - Applications that clone user-provided repository URLs are directly exploitable
🏢 Internal Only: MEDIUM - Internal systems cloning from external sources remain vulnerable

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires tricking users/applications into cloning malicious repositories

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.1.32 and later

Vendor Advisory: https://github.com/gitpython-developers/GitPython/security/advisories

Restart Required: No

Instructions:

1. Update GitPython: pip install --upgrade GitPython>=3.1.32
2. Verify installation: pip show GitPython
3. Test clone operations in your application

🔧 Temporary Workarounds

Validate repository URLs

all

Only allow cloning from trusted, whitelisted repository sources

Use multi-option clones

all

Force use of multi-options in clone operations which are not vulnerable

🧯 If You Can't Patch

  • Implement strict input validation for all repository URLs before passing to GitPython
  • Run GitPython in isolated containers or sandboxes with minimal privileges

🔍 How to Verify

Check if Vulnerable:

Check GitPython version: python -c "import git; print(git.__version__)"

Check Version:

python -c "import git; print(git.__version__)" or pip show GitPython

Verify Fix Applied:

Verify version is 3.1.32 or higher and test clone operations with known safe repositories

📡 Detection & Monitoring

Log Indicators:

  • Unexpected git clone operations
  • Clone attempts from unusual repository URLs
  • Errors in git operations

Network Indicators:

  • Git protocol traffic to unexpected domains
  • SSH git operations to unknown hosts

SIEM Query:

Search for process executions containing 'git clone' with suspicious URLs or from untrusted sources

📊 Metadata

CVE ID: CVE-2023-40267
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: August 11, 2023
Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON